case:FT-SS-09-MFT
engine:Indexed
dataset:Windows
tool:Autopsy
version:4.6
tester:JRL
host:Hathor
date:2018-08-14 11:08:30
active_hit:7008 LIVE-MFT-Ursa-mft-ascii.txt
active_hit:7009 LIVE-MFT-Ursa-mft-utf-8.txt
active_hit:7010 (70Ѐ1 or 7а^@1) LIVE-MFT-Ursa-mft-utf-16-be.txt
active_hit:7011 LIVE-MFT-Ursa-mft-utf-16-be.txt
deleted_hit:7012 DELETED-MFT-Ursa-mft-ascii.txt
deleted_hit:7013 DELETED-MFT-Ursa-mft-utf-8.txt
deleted_hit:7014 DELETED-MFT-Ursa-mft-utf-16-le.txt
deleted_hit:7015 DELETED-MFT-Ursa-mft-utf-16-be.txt
n_active_targets:4
n_active_hits:4
n_deleted_targets:4
n_deleted_hits:4
n_unalloc_targets:0
n_unalloc_hits:0
comments:
All the strings are listed as being in the $MFT, except for string ID 7011. However, the string contains the fix-up-byte and is skipped in the "indexed text" window. 
The string ID for string 7010 contains a fix-up-byte and appears corrupted in the "indexed text" window.